* [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC @ 2025-09-10 10:42 Richard W.M. Jones 2025-09-10 10:42 ` Richard W.M. Jones 0 siblings, 1 reply; 4+ messages in thread From: Richard W.M. Jones @ 2025-09-10 10:42 UTC (permalink / raw) To: selinux; +Cc: lautrbach, stephen.smalley.work v2 was here: https://lore.kernel.org/selinux/CAEjxPJ7nJ7j9HPR8yEeM8ErscZfmUr0imTwUvvwZikAqsP1EDA@mail.gmail.com/T/#u This addresses the review comments for v2. I'll note that the man page options are not exactly in alphabetical order. It seems like they started off that way, but new options have been added at the end (as I did with the new -A option). Rich. ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-10 10:42 [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC Richard W.M. Jones @ 2025-09-10 10:42 ` Richard W.M. Jones 2025-09-10 14:14 ` Stephen Smalley 0 siblings, 1 reply; 4+ messages in thread From: Richard W.M. Jones @ 2025-09-10 10:42 UTC (permalink / raw) To: selinux; +Cc: lautrbach, stephen.smalley.work SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with multiple hard links or bind mounts that have differing contexts. However doing this involves building a large internal hashtable that stores the full path of every file examined by setfiles. For filesystems that have very large numbers of files or long pathnames, this uses a lot of memory, which makes SELinux relabelling in constrained memory environments infeasible. This adds a new setfiles -A option that disables this tracking. For example, using setfiles to relabel a filesystem with 15 million files took 3.7GB of RAM. Using this option, the same filesystem can be relabelled in 121MB (albeit with no warnings or errors possible for conflicting labels, but for our use case we don't care about that.) Fixes: https://issues.redhat.com/browse/RHEL-111505 Signed-off-by: Richard W.M. Jones <rjones@redhat.com> --- policycoreutils/setfiles/setfiles.8 | 5 +++++ policycoreutils/setfiles/setfiles.c | 11 +++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 index eabf0a1c..d43e4ad2 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. .RB [ \-I | \-D ] .RB [ \-T .IR nthreads ] +.RB [ \-A ] .I spec_file .IR pathname \ ... @@ -187,6 +188,10 @@ use up to threads. Specify 0 to create as many threads as there are available CPU cores; 1 to use only a single thread (default); or any positive number to use the given number of threads (if possible). +.TP +.B \-A +do not track inodes with multiple hard links or bind mounts that would +match different contexts (saves memory) .SH "ARGUMENTS" .TP diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c index ad09f840..31034316 100644 --- a/policycoreutils/setfiles/setfiles.c +++ b/policycoreutils/setfiles/setfiles.c @@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) name, name); } else { fprintf(stderr, - "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" - "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" - "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", + "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" + "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" + "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", name, name, name); } exit(-1); @@ -147,7 +147,7 @@ int main(int argc, char **argv) const char *base; int errors = 0; const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; + const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; const char *opts; union selinux_callback cb; long unsigned skipped_errors; @@ -375,6 +375,9 @@ int main(int argc, char **argv) if (*optarg == '\0' || *endptr != '\0') usage(argv[0]); break; + case 'A': + r_opts.add_assoc = 0; + break; case 'h': case '?': usage(argv[0]); -- 2.50.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-10 10:42 ` Richard W.M. Jones @ 2025-09-10 14:14 ` Stephen Smalley 2025-09-11 19:28 ` Stephen Smalley 0 siblings, 1 reply; 4+ messages in thread From: Stephen Smalley @ 2025-09-10 14:14 UTC (permalink / raw) To: Richard W.M. Jones; +Cc: selinux, lautrbach On Wed, Sep 10, 2025 at 6:43 AM Richard W.M. Jones <rjones@redhat.com> wrote: > > SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with > multiple hard links or bind mounts that have differing contexts. > However doing this involves building a large internal hashtable that > stores the full path of every file examined by setfiles. For > filesystems that have very large numbers of files or long pathnames, > this uses a lot of memory, which makes SELinux relabelling in > constrained memory environments infeasible. > > This adds a new setfiles -A option that disables this tracking. > > For example, using setfiles to relabel a filesystem with 15 million > files took 3.7GB of RAM. Using this option, the same filesystem can > be relabelled in 121MB (albeit with no warnings or errors possible for > conflicting labels, but for our use case we don't care about that.) > > Fixes: https://issues.redhat.com/browse/RHEL-111505 > Signed-off-by: Richard W.M. Jones <rjones@redhat.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > --- > policycoreutils/setfiles/setfiles.8 | 5 +++++ > policycoreutils/setfiles/setfiles.c | 11 +++++++---- > 2 files changed, 12 insertions(+), 4 deletions(-) > > diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 > index eabf0a1c..d43e4ad2 100644 > --- a/policycoreutils/setfiles/setfiles.8 > +++ b/policycoreutils/setfiles/setfiles.8 > @@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. > .RB [ \-I | \-D ] > .RB [ \-T > .IR nthreads ] > +.RB [ \-A ] > .I spec_file > .IR pathname \ ... > > @@ -187,6 +188,10 @@ use up to > threads. Specify 0 to create as many threads as there are available > CPU cores; 1 to use only a single thread (default); or any positive > number to use the given number of threads (if possible). > +.TP > +.B \-A > +do not track inodes with multiple hard links or bind mounts that would > +match different contexts (saves memory) > > .SH "ARGUMENTS" > .TP > diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c > index ad09f840..31034316 100644 > --- a/policycoreutils/setfiles/setfiles.c > +++ b/policycoreutils/setfiles/setfiles.c > @@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) > name, name); > } else { > fprintf(stderr, > - "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" > - "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" > - "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", > + "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" > + "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" > + "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", > name, name, name); > } > exit(-1); > @@ -147,7 +147,7 @@ int main(int argc, char **argv) > const char *base; > int errors = 0; > const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; > - const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; > + const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; > const char *opts; > union selinux_callback cb; > long unsigned skipped_errors; > @@ -375,6 +375,9 @@ int main(int argc, char **argv) > if (*optarg == '\0' || *endptr != '\0') > usage(argv[0]); > break; > + case 'A': > + r_opts.add_assoc = 0; > + break; > case 'h': > case '?': > usage(argv[0]); > -- > 2.50.1 > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC 2025-09-10 14:14 ` Stephen Smalley @ 2025-09-11 19:28 ` Stephen Smalley 0 siblings, 0 replies; 4+ messages in thread From: Stephen Smalley @ 2025-09-11 19:28 UTC (permalink / raw) To: Richard W.M. Jones; +Cc: selinux, lautrbach On Wed, Sep 10, 2025 at 10:14 AM Stephen Smalley <stephen.smalley.work@gmail.com> wrote: > > On Wed, Sep 10, 2025 at 6:43 AM Richard W.M. Jones <rjones@redhat.com> wrote: > > > > SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with > > multiple hard links or bind mounts that have differing contexts. > > However doing this involves building a large internal hashtable that > > stores the full path of every file examined by setfiles. For > > filesystems that have very large numbers of files or long pathnames, > > this uses a lot of memory, which makes SELinux relabelling in > > constrained memory environments infeasible. > > > > This adds a new setfiles -A option that disables this tracking. > > > > For example, using setfiles to relabel a filesystem with 15 million > > files took 3.7GB of RAM. Using this option, the same filesystem can > > be relabelled in 121MB (albeit with no warnings or errors possible for > > conflicting labels, but for our use case we don't care about that.) > > > > Fixes: https://issues.redhat.com/browse/RHEL-111505 > > Signed-off-by: Richard W.M. Jones <rjones@redhat.com> > > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Thanks, applied. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-09-11 19:28 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-09-10 10:42 [PATCH v3] setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC Richard W.M. Jones 2025-09-10 10:42 ` Richard W.M. Jones 2025-09-10 14:14 ` Stephen Smalley 2025-09-11 19:28 ` Stephen Smalley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).